CVE-2026-39857 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS deployments should assess exposure and apply patches to prevent potential exploitation. This includes verifying current deployments, applying patches, and reviewing access controls for the REST API in ApostropheCMS. Additionally, defenders should monitor for potential exploitation attempts on the ApostropheCMS system and review compensating controls for exposed systems.

Why it matters

Defenders should care about CVE-2026-39857 because it allows unauthorized access to sensitive data in ApostropheCMS deployments, potentially leading to data exposure and misuse. The vulnerability affects ApostropheCMS versions 4.28.0 and prior, and patches are available in version 4.29.0 and later.

• Potential data exposure through unauthorized access to distinct field values.
• Possible misuse of extracted field values for further attacks.
• Need for verification of current deployments and application of patches.
• Potential impact on data integrity and confidentiality.

Technical summary

ApostropheCMS versions 4.28.0 and prior contain an authorization bypass vulnerability in the choices and counts query parameters of the REST API. This vulnerability allows an unauthenticated attacker to extract all distinct field values for any schema field type that has a registered query builder, including string, integer, float, select, boolean, date, slug, and relationship fields. Fields protected with viewPermission are similarly exposed, and the counts variant additionally reveals how many documents have each distinct value.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for ApostropheCMS versions 4.28.0 and prior.

Recommended defensive actions

• Verify exposure of ApostropheCMS versions 4.28.0 and prior to the authorization bypass vulnerability.
• Apply patches to ApostropheCMS by upgrading to version 4.29.0 or later.
• Review and update access controls for the REST API in ApostropheCMS.
• Monitor for potential exploitation attempts on the ApostropheCMS system.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the authorization bypass vulnerability in ApostropheCMS versions 4.28.0 and prior. The vulnerability allows an unauthenticated attacker to extract all distinct field values for any schema field type that has a registered query builder. The choices and counts parameters are processed via applyBuildersSafely before the projection is applied, and MongoDB's distinct operation does not respect projections, returning all distinct values directly.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.